Security decisions

RS256, not HS256#

Access tokens are signed with an asymmetric key pair. middleware.ts verifies with the public key only, so the private key never touches Edge Runtime. A compromised edge deployment cannot mint tokens.

Refresh token rotation#

Every use issues a new token. Reuse of a revoked token triggers full chain revocation, verified against real Redis in the test suite.

API keys stored as hash only#

SHA-256 hash storage. The full key is displayed once at creation and never again. See API keys.

Webhook signature verification#

stripe.webhooks.constructEvent() runs on the raw body, always, with no exceptions. An early version of the handler returned the same 400 for an invalid signature and for a transient database error, which meant Stripe stopped retrying and billing events could vanish. Catching that class of bug is the actual work, and it is what the tests exist to prevent.

Fail-closed quota, fail-open rate limiter#

Quota checks fail closed, so an infrastructure failure never grants free paid usage. The rate limiter fails open, so a Redis outage does not take your product down. Both behaviours are documented in code, see rate limiting.